Privacy, terms & accessibility
Version 1.13. Published 24 October 2026.
Business details
David Paul Butler, trading as Claridyne
2 Mulberry Close, Conwy,
LL32 8GS, United Kingdom
support@claridyne.tech
ICO registration: ZC238647
Claridyne is a trading name of David Paul Butler, a sole trader. David Paul Butler is the data controller for the personal data described in this notice and is registered with the Information Commissioner's Office.
For privacy questions, rights requests and complaints, write to privacy@claridyne.tech. For help with an assessment or your account, write to support@claridyne.tech.
Who we sell to
Claridyne sells to businesses only. When you register and when you buy an assessment you confirm that you are acting in the course of a business, and we record that confirmation against your account and your order. Sole traders and partnerships buying for their business are included. We do not sell to consumers, so the cancellation rights that apply to consumer contracts do not apply here. Section 7 sets out the cancellation and refund position that does apply.
Privacy notice
What we collect
We collect your business email address, your business name, your password in hashed form, your two-factor authentication settings, your questionnaire answers, your AI Policy Kit answers, any project brief you send us, any request you send through our contact form, your orders and the reports we deliver to you. We also record security and administrative events, such as sign-ins, submissions and report downloads. For an order you pay by invoice, we also collect the company name to invoice, the billing address, the billing email address and any purchase order number you give us. If you buy the AI Policy Kit, we also keep the trading name you give us, if you give one, which may be your own name.
Please don't send us personal records about your own clients or staff, special category data, passwords or API keys. Our questionnaires never ask for them, and the assessments don't need them. The AI Policy Kit asks for the name or role of the person responsible for AI in your business and the email address your customers use to reach you. Use business contact details there.
Why we use it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Creating your account and delivering the assessment or AI Policy Kit you bought | Performance of a contract |
| Contacting the individual named on a company account about that company's orders | Legitimate interests, being the administration of the business relationship with that company |
| Service emails, such as email verification, password resets and report-ready notices | Performance of a contract |
| Account security, two-factor authentication, rate limiting (including on the AI compliance check), audit logging and fraud prevention | Legitimate interests, being the protection of the service and of customer data |
| Replying to a contact form request about our services | Steps taken at your request before a contract (Article 6(1)(b) UK GDPR) |
| Keeping transaction and tax records | Legal obligation |
| Running the free AI compliance check and emailing you the report you asked for | Steps taken at your request, to provide the service you asked for (Article 6(1)(b) UK GDPR) |
| Follow-up emails about AI compliance, tailored to the areas your check flagged, and the AI Policy Kit list | Consent, which you can withdraw at any time. Use the unsubscribe link in any follow-up email or the unsubscribe button your email app shows, or email privacy@claridyne.tech |
For an order paid by invoice, we use the billing details to issue the invoice and record payment. That is necessary to carry out the contract you make when you place the order. We keep the invoice and payment records for tax purposes, because the law requires it.
We do not send marketing email, apart from the follow-up emails described under AI compliance check below, which we send only with your consent. We do not make automated decisions that produce legal or similarly significant effects. Your questionnaire answers and reports are not sent to an AI model automatically. If we ever want to change either of those things, we will update this notice first and obtain consent where the law requires it.
Who else handles your data
- Mollie processes payments. Card details go directly to Mollie and never reach our servers. We store only a payment reference and the amount. The contracting entity is Mollie UK Ltd, registered in England and Wales (company 14013554) and authorised by the Financial Conduct Authority (FRN 977968). Mollie B.V. in the Netherlands provides some payment methods. Mollie acts as a controller in its own right for the payment data it collects, and its own privacy statement explains how it uses that data.
- Lettermint B.V., based in the Netherlands, sends our service emails. It acts as our processor and handles the email data on infrastructure in the European Union.
- Xero (UK) Limited, 5th Floor, 100 Avebury Boulevard, Milton Keynes, MK9 1FH, which holds the invoices we issue and the billing details on them, for an order you pay by invoice. It acts as our processor. Xero hosts its service on servers in the United States, and may also process data in New Zealand and Australia. Transfers are covered by the EU Standard Contractual Clauses, as adopted in the UK through the ICO's International Data Transfer Addendum. Xero keeps the data for the length of our agreement and for up to 7 years after it ends. Only billing details go to Xero. Your questionnaire answers, reports and free check details never do.
- Proton AG, based in Switzerland, hosts our support and privacy mailboxes. It acts as our processor for the emails you send us and our replies.
- Our servers and encrypted backups are held with a hosting provider in the European Economic Area, acting as our processor. We will name the provider on request.
We have written data processing terms in place with each processor. We don't sell your data, and we don't share it for anyone else's marketing.
Where your data goes
Your account, answers and reports are stored in the European Economic Area. Lettermint processes email data in the European Union. The United Kingdom has recognised the European Economic Area as providing an adequate level of protection, so no additional international transfer mechanism is needed while both stay EU-based. We pass payment data to Mollie UK Ltd in the United Kingdom, so that is not an international transfer. Proton AG stores our mailboxes on its servers in Switzerland, Germany or Norway. The United Kingdom recognises all three as adequate, so no additional mechanism is needed there either. One exception: the billing details for an invoice order are held by Xero, which hosts in the United States. That transfer relies on the Standard Contractual Clauses with the UK Addendum, described under who else handles your data.
How long we keep it
| Record | Retention period |
|---|---|
| Account details and questionnaire answers, including AI Policy Kit answers | Until you delete your account, or 12 months after your last completed order (12 months after registration if you have not completed one), whichever comes first |
| Delivered reports held in your portal | 12 months from delivery. Please keep your own copy |
| Transaction, invoice and tax records, with personal details removed. The billing address, billing email and purchase order number go when your account is deleted | 6 years from the end of the relevant tax year, as HMRC requires |
| Security and audit events | 12 months |
| Contact form requests: your name, email address, company and message | 12 months from when we receive them. We erase them sooner if you ask us to |
| Encrypted database backups | 35 days |
| Outgoing email queue | 30 days |
| Email verification and password reset tokens | Hours, set by the token's expiry |
| AI compliance check, not yet confirmed by email | 30 days from the check |
| AI compliance check, confirmed by email | 12 months from confirmation. If an account with the same email address has an assessment order that is paid, in progress, cancellation requested or complete, we keep the check for as long as that account exists. Deleting the account, or the account being removed under the rules above, deletes the check. The record of which follow-up or kit list emails we sent for the check goes with it |
| Record that you withdrew marketing consent for the AI compliance check by emailing us | Kept as a keyed hash, not your address, so a later check doesn't record your consent again. No fixed period |
AI compliance check
The free AI compliance check at /check.html asks about your business's AI and privacy practices and gives you a short result. First you say which describes you: a registered company or LLP, a sole trader or partnership, or a business that isn't trading yet. A company enters its company number. We fetch the company's public profile from Companies House and keep the company number and company name. Anyone else can give an optional trading name, which may be their own name, and we keep it only if you give one. We also keep which description you chose, your answers and your results. We don't keep the company's postcode or sector codes.
If you ask for your report by email, we keep your email address encrypted in the check record, with a keyed hash of it that lets us match the address without reading it. The address also sits unencrypted in our outgoing email queue for up to 30 days. We send you a link to confirm the address and store only a hash of that link's token, which expires after 7 days. We use your address for that link and for nothing else unless you tick the box agreeing to follow-up advice and offers about AI compliance.
We don't store your IP address for the check, and our web server doesn't log check requests. To limit abuse, the check keeps your IP address only in hashed form, held in temporary memory for up to 15 minutes and not linked to your answers.
We use your details to run the check and send your report, because you asked for it. If you tick the box, we keep your consent, the exact wording you saw and the time you gave it. We send follow-up email only with that consent. With it, we use your check answers to choose which areas each follow-up email covers: the areas your check flagged, and nothing else. We keep a record of which follow-up emails we queued for your check, and when, and nothing about what they said. You can withdraw consent at any time. Use the unsubscribe link in any follow-up or kit list email or the unsubscribe button your email app shows, or email privacy@claridyne.tech. Once you do, we send you no more follow-up or kit list email. If you gave consent and tell us on your report page that you want to hear about the AI Policy Kit, we record that interest against your check. We also keep anonymous daily totals of how many people reach each step, which hold no personal data.
Companies House is the public register, based in the United Kingdom. We send it the company number you enter and nothing else. Our email provider, Lettermint, sends your confirmation link as our processor, in the European Union. The check's data is stored on our servers in the European Economic Area. Nothing about the check goes to an AI service.
Check data isn't linked to a portal account by ID, so you can't view or delete it yourself. Deleting your account also deletes any checks made with its email address. To see, correct or erase other checks, or to withdraw consent, write to privacy@claridyne.tech from the address you used.
Your rights
You have the right to ask for a copy of your personal data, to have it corrected or erased, to restrict or object to how we use it, and to receive it in a portable form. You can download your account data and delete your account yourself from the account area, once any active orders are resolved. Deleting your account removes your account details, questionnaire answers, project briefs, reports and the AI compliance checks made with your email address from the live service. Transaction records remain in the anonymised form described above, and encrypted backups age out on the 35-day cycle rather than being edited.
To exercise any right, write to privacy@claridyne.tech. We will respond within one month. If a request is complex we may extend that by up to two further months, and we will tell you if we do.
Complaints
If you're unhappy with how we've handled your personal data, tell us first at privacy@claridyne.tech. We will acknowledge your complaint within 5 working days and give you a substantive response within 30 days. You can also complain to the Information Commissioner's Office at any time, and going to us first doesn't affect that right.
Business service terms
These terms, version 1.13, form the agreement between you and David Paul Butler trading as Claridyne. The version you accepted at the time of your order governs that order.
1. Business customers only
The services are offered to customers acting in the course of a business. By registering and by placing an order you confirm that you are doing so.
2. Services and prices
The AI Readiness assessment is £499. The AI Governance review is £1,500. The AI Policy Kit is £149. It is sold to any business, whether it's a company, a sole trader, a partnership or a business that isn't trading yet. A company gives its company number, which we check against Companies House when you buy. Anyone else can give an optional trading name, which may be their own name. Concierge work is scoped and priced separately, following a discovery call and a fixed-price quote. Claridyne is not currently registered for VAT, so no VAT is charged. If registration becomes required, prices and invoices will be updated accordingly.
3. Payment
The AI Policy Kit is paid in full through Mollie Checkout before it is unlocked. An assessment is paid by invoice, or by card through Mollie Checkout where we offer that. Card payment is taken before the questionnaire unlocks.
If you pay by invoice, the questionnaire opens when you place your order, and work starts then, before payment. We email the invoice to the billing email address you give us. Payment is due within 14 days of the invoice date. Invoices show no VAT, as we're not VAT registered. If an invoice isn't paid by its due date, statutory interest and fixed compensation for late payment apply under the Late Payment of Commercial Debts (Interest) Act 1998. Interest runs at 8 per cent a year above the Bank of England base rate, from the day after the due date until payment. Fixed compensation is £40 for a debt under £1,000, £70 for a debt from £1,000 to £9,999.99, and £100 for a debt of £10,000 or more.
Concierge work requires a deposit of 50 per cent to begin, with the balance due on delivery.
4. Delivery
The readiness deadline starts when you submit a completed questionnaire and runs for 3 business days counted continuously across weekdays, excluding England and Wales bank holidays. The governance review deadline starts on submission and runs for 10 working days, counted on the same basis. Your portal shows the calculated deadline. Concierge milestones and acceptance criteria are agreed in writing. The AI Policy Kit is delivered straight away: its documents are ready to download from your portal as soon as you submit its questionnaire.
5. Your responsibilities
The assessment reflects the information you supply, so please make it accurate and complete. You must not submit personal records about your own clients or staff, special category data, passwords or API keys. If a deadline depends on information we've asked you for, it runs from the point we receive it.
6. What an assessment or kit is, and is not
Assessments are advisory reviews. They are not certifications, accreditations, audits, legal opinions or guarantees that your systems are secure or compliant. The governance review identifies gaps in how you manage AI; it is not legal advice and does not include security testing. You remain responsible for your own business decisions and for implementing anything we recommend. The AI Policy Kit's documents are templates for you to adapt to your business. They are not legal advice, and you remain responsible for checking that they fit how you work before you rely on them.
7. Cancellation and refunds
You may request cancellation from your portal at any time. There is no automatic right to a refund once work has begun. Each request is reviewed individually, taking account of what has been delivered, and any refund we agree is returned to the original payment method. We will tell you the outcome in writing. For an invoice order, we void the invoice if you cancel before you pay, and any refund we agree is paid by bank transfer, which we record. Because the AI Policy Kit is delivered as soon as you submit its questionnaire, there is no refund once its documents are available to download. Until then, you may request cancellation in the usual way. Sales are to businesses only, so consumer cancellation rights do not apply.
8. Intellectual property
Once you have paid in full, the report or AI Policy Kit documents we deliver to you are yours, and you may use and adapt them throughout your business. We keep ownership of our questionnaires, methodology, templates, tooling and know-how, including anything we improve while carrying out the work. We may apply the general knowledge and experience we gain to other engagements, provided we do not disclose your confidential information or identify you.
9. Confidentiality
Each of us will keep the other's confidential information in confidence and use it only for the purposes of the engagement. This does not apply to information that is already public, that is received legitimately from someone else, or that must be disclosed by law.
10. Liability
Our total liability to you in connection with an assessment, whether in contract, tort including negligence, or otherwise, is limited to the fees you paid for the assessment the claim relates to.
We are not liable for loss of profit, loss of revenue, loss of anticipated savings, loss of business or goodwill, loss or corruption of data, or any indirect or consequential loss.
Nothing in these terms limits or excludes our liability for death or personal injury caused by our negligence, for fraud or fraudulent misrepresentation, or for anything else that cannot lawfully be limited or excluded.
11. Suspension and termination
We may suspend or close an account that is used unlawfully, that threatens the security of the service, or that is in material breach of these terms. Where it is reasonable to do so we will warn you first and give you the chance to put things right.
12. Changes to these terms
We may update these terms for future orders. The version in force when you placed an order continues to govern that order, and we keep a record of the version you accepted.
13. Complaints
If something has gone wrong, write to support@claridyne.tech. We will acknowledge your complaint within 5 working days and give you a substantive response within 20 working days. Data protection complaints are handled as described in the privacy notice above.
14. Governing law
These terms and any dispute arising from them are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.
Accessibility
We're aiming for WCAG 2.2 Level AA. The site is built for keyboard use, respects reduced motion settings, labels its forms and gives errors in text rather than by colour alone. Authenticator setup offers a text key as well as a QR code, and the account forms work with password managers and pasted codes.
We last reviewed the site on 24 October 2026. Automated accessibility checks run on every change. We've tested keyboard use, zoom up to 400% and text spacing across the customer journey, and the screen-reader experience with VoiceOver on iPad. We check every report PDF against the PDF/UA accessibility standard before we send it. We know of no barriers. This is our own review, not an independent audit.
If you hit a barrier or need a report in a different format, write to support@claridyne.tech and we will sort it out.